{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-44966", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.667Z", "datePublished": "2024-09-04T18:38:45.625Z", "dateUpdated": "2026-08-05T11:37:20.222Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:20.222Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_flat: Fix corruption when not offsetting data start\n\nCommit 04d82a6d0881 (\"binfmt_flat: allow not offsetting data start\")\nintroduced a RISC-V specific variant of the FLAT format which does\nnot allocate any space for the (obsolete) array of shared library\npointers. However, it did not disable the code which initializes the\narray, resulting in the corruption of sizeof(long) bytes before the DATA\nsegment, generally the end of the TEXT segment.\n\nIntroduce MAX_SHARED_LIBS_UPDATE which depends on the state of\nCONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET to guard the initialization of\nthe shared library pointer region so that it will only be initialized\nif space is reserved for it." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is triggered by execve() of an attacker-supplied bFLT file, requiring local access to the system. There is no network-facing path into binfmt_flat.\nAC:L - The defective loop runs unconditionally on every flat-binary load on an affected kernel, and the attacker fully controls the flat header fields (notably data_start) that place the write below the allocation base. No race, no unpredictable state, and success is deterministic on every attempt.\nPR:L - Any unprivileged local user who can write and exec a file reaches load_flat_binary(); binfmt_flat performs no capability or credential check beyond ordinary execute permission. No root or user-namespace trickery is needed.\nUI:N - The attacker executes their own crafted binary directly; no other user or victim action is involved in reaching the vulnerable code.\nS:U - The out-of-bounds write corrupts memory managed by the same kernel that is exploited; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The value stored is a kernel address (datapos) written into memory outside the process's allocation, which on a no-MMU flat address space can be read by whatever else owns that page, and the corruption primitive can be leveraged against adjacent structures for broader disclosure.\nI:H - This is an out-of-bounds write of a pointer-sized value below the start of an alloc_pages_exact() allocation with put_user() unchecked on nommu, corrupting adjacent kernel-owned memory; even in the benign case it silently rewrites the loaded executable's TEXT.\nA:H - Corrupting the word preceding a buddy-allocated page damages arbitrary neighbouring kernel data and can panic the system, and in the in-image case it corrupts the executing program's code so it faults. Any local user can repeat it at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/binfmt_flat.c" ], "versions": [ { "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "3a684499261d0f7ed5ee72793025c88c2276809c", "status": "affected", "versionType": "git" }, { "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "af65d5383854cc3f172a7d0843b628758bf462c8", "status": "affected", "versionType": "git" }, { "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "49df34d2b7da9e57c839555a2f7877291ce45ad1", "status": "affected", "versionType": "git" }, { "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "9350ba06ee61db392c486716ac68ecc20e030f7c", "status": "affected", "versionType": "git" }, { "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "3eb3cd5992f7a0c37edc8d05b4c38c98758d8671", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/binfmt_flat.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.106", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.47", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.6", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.106" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.47" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.10.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3a684499261d0f7ed5ee72793025c88c2276809c" }, { "url": "https://git.kernel.org/stable/c/af65d5383854cc3f172a7d0843b628758bf462c8" }, { "url": "https://git.kernel.org/stable/c/49df34d2b7da9e57c839555a2f7877291ce45ad1" }, { "url": "https://git.kernel.org/stable/c/9350ba06ee61db392c486716ac68ecc20e030f7c" }, { "url": "https://git.kernel.org/stable/c/3eb3cd5992f7a0c37edc8d05b4c38c98758d8671" } ], "title": "binfmt_flat: Fix corruption when not offsetting data start", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-44966", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:39:30.735328Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:35.153Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:14:13.583Z" } } ] } }